I'm doing some traceroute scans and just realized, that there is an IP-address mismatch. Closer, my public IP-address doesn't match with the next HOP IP-address of my ISP.

So, when I scan the public IP-address of my modem, tracert tells me, that the router with his public IP is one HOP away. Of course, because I'm inside the private network of this router. This as well means, that the "inside" IP-address of my router is (for example) and my outside address is the public address of my router (, for example).

But here is the question:

How does it come, that when I traceroute, the second hop IP-address, so after my gateway, is a private address.

And what technology is used, that my outside IP is able to route to the private IP of the ISP?

Doesn't that mean, that my public address faces a private address? Here is a tracert output:

  1    <1 ms    <1 ms    <1 ms
  2     3 ms     3 ms    11 ms
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 14, 2017 at 23:14

2 Answers 2


Your ISP could have network built based on RFC1918 IP addresses. Then somewhere on the way there is NAT applied to translate IP address.


Apparently, your ISP is using CGN (Carrier-Grade NAT). See RFC 6264, An Incremental Carrier-Grade NAT (CGN) for IPv6 Transition. Some ISPs foolishly use RFC 1918 Private Address space for this instead of the IANA reserved address block: RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space). This range is Most ISPs don't use the range assigned by IANA for this, they just use regular RFC 1918 address space.

The RIRs have run out of IPv4 addresses to assign to the ISPs, so the ISPs are turning to CGN to assign non-public IPv4 addresses to residential customers, saving their precious pool of public IP addresses for business customers willing to pay a premium for public IPv4 addresses.

From RFC 6598:

1. Introduction

IPv4 address space is nearly exhausted. However, ISPs must continue to support IPv4 growth until IPv6 is fully deployed. To that end, many ISPs will deploy a Carrier-Grade NAT (CGN) device, such as that described in [RFC6264]. Because CGNs are used on networks where public address space is expected, and currently available private address space causes operational issues when used in this context, ISPs require a new IPv4 /10 address block. This address block will be called the "Shared Address Space" and will be used to number the interfaces that connect CGN devices to Customer Premises Equipment (CPE).

Shared Address Space is similar to [RFC1918] private address space in that it is not globally routable address space and can be used by multiple pieces of equipment. However, Shared Address Space has limitations in its use that the current [RFC1918] private address space does not have. In particular, Shared Address Space can only be used in Service Provider networks or on routing equipment that is able to do address translation across router interfaces when the addresses are identical on two different interfaces.

This document requests the allocation of an IPv4 /10 address block to be used as Shared Address Space. In conversations with many ISPs, a /10 is the smallest block that will allow them to deploy CGNs on a regional basis without requiring nested CGNs. For instance, as described in [ISP-SHARED-ADDR], a /10 is sufficient to service Points of Presence in the Tokyo area.

This document details the allocation of an additional special-use
IPv4 address block and updates [RFC5735].

The RFC also lists some of the problems caused by CGN:

5.2. Empirical Data

The primary motivation for the allocation of Shared Address Space is as address space for CGNs; the use and impact of CGNs has been previously described in [RFC6269] and [NAT444-IMPACTS]. Some of the services adversely impacted by CGNs are as follows:

  1. Console gaming -- some games fail when two subscribers using the same outside public IPv4 address try to connect to each other.

  2. Video streaming -- performance is impacted when using one of several popular video-streaming technologies to deliver multiple video streams to users behind particular CPE routers.

  3. Peer-to-peer -- some peer-to-peer applications cannot seed content due to the inability to open incoming ports through the CGN. Likewise, some SIP client implementations cannot receive incoming calls unless they first initiate outgoing traffic or open an incoming port through the CGN using the Port Control Protocol (PCP) [PCP-BASE] or a similar mechanism.

  4. Geo-location -- geo-location systems identify the location of the CGN server, not the end host.

  5. Simultaneous logins -- some websites (particularly banking and social-networking websites) restrict the number of simultaneous logins per outside public IPv4 address.

  6. 6to4 -- 6to4 requires globally reachable addresses and will not work in networks that employ addresses with limited topological span, such as those employing CGNs.


Based on your comments, I see that you are confused. You think the addressing looks like this:[LAN-Your Router-WAN]<-->[ISP router]Internet

In reality, it looks something like this:[LAN-Your Router-WAN]<-->[ISP router]<-->Internet

When you go to a web site that reports your public address, it only sees the ISP public address since the private addresses assigned to your router cannot be routed on the public Internet. That public address is not on your router, it is on an ISP router. All your traffic gets translated on your router between two private address blocks, and it gets translated again on the ISP router from private to public addresses. That double NAT may cause problems for you, depending on what you try to do.

  • But even though they are using CGN, how does it work that my public IP-address that is directly on the router, is compatible with the next Hop IP which is a private IP, that is not even in the same network? Even with NAT the next HOP router should be shown.
    – Login
    Commented Aug 10, 2016 at 6:55
  • All unicast IP addresses are compatible through a router because routers route between network. The line between private and public IP addresses is artificial. The only difference is that ISPs have agreed not to route the RFC 1918 (and a few other) addresses between them. Your ISP is free to route any addresses in its own network, including RFC 1918 and CGN addresses. It must NAT those addresses before sending traffic with those addresses out to other ISPs. The Internet is merely ISPs routing to each other.
    – Ron Maupin
    Commented Aug 10, 2016 at 13:52
  • The next hop router (your ISP's router) happens to be using a private RFC 1918 address, too. The problem with an ISP doing that is that it may be using the same RFC 1918 address block that some of its customers may be using, and that can be a problem, which is why IANA and the IETF decided on the separate CGN address block of Your private address block happens to be different than the private address block used by your ISP, so there is no problem, except for the double-NAT that causes certain problems, some of which are listed in my answer.
    – Ron Maupin
    Commented Aug 10, 2016 at 13:58
  • But I know, that the routing part inside their network can be done with a private IP range. The thing I don't quite get, is the fact that my public IP, which can be tracerouted down to be directly at my router, has a private IP as next HOP IP. I'm trying to visually display my problem: my network)-ROUTER- my public IP)------------------- next Hop IP)-Next-Hop-Router.
    – Login
    Commented Aug 11, 2016 at 6:52
  • As you can see, faces on the other side, and they are clearly not in the same network. And I think, that even with NAT an IP-address in the same network should be the next Hop ip.
    – Login
    Commented Aug 11, 2016 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.